Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 30, 2026, 00:00–24:00 UTC · published August 31, 2026 09:18 UTC.

Last checked about 15 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

476 pages changed +3248 −310

New Microsoft 365 connector supersedes the legacy one; Cortex Data Security moves out of Cloud Security

  • A new Microsoft 365 connector page lands with full setup steps; the old page is renamed Microsoft365 (legacy) and gets a migration guide.
  • Cortex Data Security moves from Cloud Security into its own section, and its licence hint now names a Data Security licence or add-on.
  • A 2,000-field limit per dataset is documented, together with a new fields stage for the INGEST section of a parsing rule to work around it.
  • Four SaaS connectors — Microsoft 365, Microsoft Teams, Google Workspace and Anthropic Claude — replace “follow the configuration wizard” with prerequisites, API scopes and task-by-task setup.
  • Most of the 477 files are a metadata sweep: 409 pages gained a front-matter description and 130 section landing pages swapped link tables for bullet lists.
  • README
  • Navigation manifest (xsiam)
  • Cortex XDR Agent Past Releases Archive
  • Cortex Data Security
  • Gain visibility and assess risk of API endpoints
  • 1Password
  • and 470 more

See what changed →

Analytics rules

0 rules changed +0 −0

Synced, and nothing changed upstream.

Content packs

3 packs changed +3106 −53

AggregatedScripts gains a block-domain aggregate command; Exchange on-prem adds a credentials fallback

  • Three packs move across four upstream commits, +3,106/-53 — nearly all of it in one pack.
  • AggregatedScripts takes +2,955 against a single deletion, alongside a commit adding the aggregate command block-domain (#45619).
  • MicrosoftExchangeOnPremise takes +116/-17, alongside a fallback to creds commit and its revert.
  • Palo_Alto_Networks_Enterprise_DLP changes 35 lines for 35, a like-for-like replacement with no net growth. The day’s remaining commit is a support fix, XSUP-74481 (#45567).
  • AggregatedScripts
  • MicrosoftExchangeOnPremise
  • Palo_Alto_Networks_Enterprise_DLP

See what changed →

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.